CS-725 [Bug] - Validate comment length against visible text, not raw Tiptap JSON

apps/api/src/comments/dto/create-comment.dto.spec.ts

@@ -0,0 +1,99 @@
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { CreateCommentDto } from './create-comment.dto';
+
+// create-comment.dto.ts imports the `CommentEntityType` enum from `@db`,
+// which eagerly instantiates the Prisma client on import — mock it so this
+// spec doesn't need a configured DB connection (mirrors comments.controller.spec.ts).
+jest.mock('@db', () => ({
+  db: {},
+  CommentEntityType: {
+    task: 'task',
+    vendor: 'vendor',
+    risk: 'risk',
+    policy: 'policy',
+    finding: 'finding',
+  },
+}));
+
+function tiptapDoc(content: unknown[]): string {
+  return JSON.stringify({ type: 'doc', content });
+}
+
+function toDto(plain: Record<string, unknown>): CreateCommentDto {
+  return plainToInstance(CreateCommentDto, plain, {
+    enableImplicitConversion: true,
+  });
+}
+
+const VALID_BASE = {
+  entityId: 'tsk_abc123',
+  entityType: 'task',
+};
+
+describe('CreateCommentDto', () => {
+  it('accepts a plain-text comment under the limit', async () => {
+    const dto = toDto({ ...VALID_BASE, content: 'Looks good to me' });
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('rejects a plain-text comment over 2000 visible characters', async () => {
+    const dto = toDto({ ...VALID_BASE, content: 'x'.repeat(2001) });
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'content')).toBe(true);
+  });
+
+  it('accepts a formatted Tiptap comment whose raw JSON exceeds 2000 chars but whose visible text does not (regression for the reported bug)', async () => {
+    const words = Array.from({ length: 240 }, (_, i) => ({
+      type: 'text',
+      text: 'word ',
+      ...(i % 2 === 0 ? { marks: [{ type: 'bold' }] } : {}),
+    }));
+    const content = tiptapDoc([{ type: 'paragraph', content: words }]);
+    expect(content.length).toBeGreaterThan(2000);
+
+    const dto = toDto({ ...VALID_BASE, content });
+    const errors = await validate(dto);
+    expect(errors).toHaveLength(0);
+  });
+
+  it('rejects a formatted Tiptap comment whose visible text exceeds 2000 characters', async () => {
+    const content = tiptapDoc([
+      {
+        type: 'paragraph',
+        content: [
+          {
+            type: 'text',
+            text: 'a'.repeat(2001),
+            marks: [{ type: 'bold' }],
+          },
+        ],
+      },
+    ]);
+
+    const dto = toDto({ ...VALID_BASE, content });
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'content')).toBe(true);
+  });
+
+  it('rejects an empty comment', async () => {
+    const dto = toDto({ ...VALID_BASE, content: '' });
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'content')).toBe(true);
+  });
+
+  it('rejects a non-doc JSON payload over the limit instead of treating it as empty (bypass regression)', async () => {
+    const content = `{"foo": "${'x'.repeat(2001)}"}`;
+    const dto = toDto({ ...VALID_BASE, content });
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'content')).toBe(true);
+  });
+
+  it('rejects an empty Tiptap document — non-empty JSON string but zero visible text (regression)', async () => {
+    const content = tiptapDoc([]);
+    const dto = toDto({ ...VALID_BASE, content });
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'content')).toBe(true);
+  });
+});

apps/api/src/comments/dto/create-comment.dto.ts

@@ -11,16 +11,25 @@ import {
   ValidateNested,
 } from 'class-validator';
 import { UploadAttachmentDto } from '../../attachments/upload-attachment.dto';
+import { MaxCommentTextLength } from '../validators/max-comment-text-length.validator';
+
+// `content` is serialized Tiptap JSON (or plain text for API callers). The
+// 2000-char limit applies to the visible text a user typed, not the raw
+// JSON — see MaxCommentTextLength. This raw-string cap only bounds payload
+// size against pathologically formatted input.
+const RAW_CONTENT_MAX_LENGTH = 50_000;
 
 export class CreateCommentDto {
   @ApiProperty({
-    description: 'Content of the comment',
+    description:
+      'Content of the comment (plain text or serialized Tiptap JSON). Limited to 2000 characters of visible text; maxLength bounds the serialized payload size, not the visible text.',
     example: 'This task needs to be completed by end of week',
-    maxLength: 2000,
+    maxLength: RAW_CONTENT_MAX_LENGTH,
   })
   @IsString()
   @IsNotEmpty()
-  @MaxLength(2000)
+  @MaxLength(RAW_CONTENT_MAX_LENGTH)
+  @MaxCommentTextLength(2000)
   content: string;
 
   @ApiProperty({

apps/api/src/comments/dto/update-comment.dto.ts

@@ -1,15 +1,24 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { IsNotEmpty, IsOptional, IsString, MaxLength } from 'class-validator';
+import { MaxCommentTextLength } from '../validators/max-comment-text-length.validator';
+
+// `content` is serialized Tiptap JSON (or plain text for API callers). The
+// 2000-char limit applies to the visible text a user typed, not the raw
+// JSON — see MaxCommentTextLength. This raw-string cap only bounds payload
+// size against pathologically formatted input.
+const RAW_CONTENT_MAX_LENGTH = 50_000;
 
 export class UpdateCommentDto {
   @ApiProperty({
-    description: 'Updated content of the comment',
+    description:
+      'Updated content of the comment (plain text or serialized Tiptap JSON). Limited to 2000 characters of visible text; maxLength bounds the serialized payload size, not the visible text.',
     example: 'This task needs to be completed by end of week (updated)',
-    maxLength: 2000,
+    maxLength: RAW_CONTENT_MAX_LENGTH,
   })
   @IsString()
   @IsNotEmpty()
-  @MaxLength(2000)
+  @MaxLength(RAW_CONTENT_MAX_LENGTH)
+  @MaxCommentTextLength(2000)
   content: string;
 
   @ApiProperty({

apps/api/src/comments/utils/extract-comment-plain-text.spec.ts

@@ -0,0 +1,152 @@
+import { extractCommentPlainText } from './extract-comment-plain-text';
+
+function tiptapDoc(content: unknown[]): string {
+  return JSON.stringify({ type: 'doc', content });
+}
+
+describe('extractCommentPlainText', () => {
+  it('returns plain text as-is when content is not JSON', () => {
+    expect(extractCommentPlainText('Just a plain comment')).toBe(
+      'Just a plain comment',
+    );
+  });
+
+  it('extracts an empty string from an empty Tiptap document', () => {
+    expect(extractCommentPlainText(tiptapDoc([]))).toBe('');
+  });
+
+  it('returns plain text as-is when it happens to be valid JSON but not a Tiptap doc (bypass regression)', () => {
+    const longPlainText = 'x'.repeat(3000);
+    const jsonLookingText = `{"foo": "${longPlainText}"}`;
+    expect(extractCommentPlainText(jsonLookingText)).toBe(jsonLookingText);
+
+    const jsonArrayLookingText = `["${longPlainText}"]`;
+    expect(extractCommentPlainText(jsonArrayLookingText)).toBe(
+      jsonArrayLookingText,
+    );
+  });
+
+  it('extracts text from a simple paragraph', () => {
+    const content = tiptapDoc([
+      {
+        type: 'paragraph',
+        content: [{ type: 'text', text: 'Hello world' }],
+      },
+    ]);
+    expect(extractCommentPlainText(content)).toBe('Hello world');
+  });
+
+  it('ignores formatting marks — bold text counts the same as plain text', () => {
+    const content = tiptapDoc([
+      {
+        type: 'paragraph',
+        content: [
+          { type: 'text', text: 'This word is ' },
+          { type: 'text', text: 'bold', marks: [{ type: 'bold' }] },
+          { type: 'text', text: '.' },
+        ],
+      },
+    ]);
+    expect(extractCommentPlainText(content)).toBe('This word is bold.');
+  });
+
+  it('counts one character per hard break and per paragraph boundary', () => {
+    const content = tiptapDoc([
+      {
+        type: 'paragraph',
+        content: [
+          { type: 'text', text: 'Line one' },
+          { type: 'hardBreak' },
+          { type: 'text', text: 'Line two' },
+        ],
+      },
+      {
+        type: 'paragraph',
+        content: [{ type: 'text', text: 'Second paragraph' }],
+      },
+    ]);
+    expect(extractCommentPlainText(content)).toBe(
+      'Line one\nLine two\nSecond paragraph',
+    );
+  });
+
+  it('renders a mention as @label', () => {
+    const content = tiptapDoc([
+      {
+        type: 'paragraph',
+        content: [
+          { type: 'text', text: 'Hey ' },
+          { type: 'mention', attrs: { id: 'usr_1', label: 'Jane Doe' } },
+        ],
+      },
+    ]);
+    expect(extractCommentPlainText(content)).toBe('Hey @Jane Doe');
+  });
+
+  it('extracts text from a bullet list', () => {
+    const content = tiptapDoc([
+      {
+        type: 'bulletList',
+        content: [
+          {
+            type: 'listItem',
+            content: [
+              {
+                type: 'paragraph',
+                content: [{ type: 'text', text: 'Item one' }],
+              },
+            ],
+          },
+          {
+            type: 'listItem',
+            content: [
+              {
+                type: 'paragraph',
+                content: [{ type: 'text', text: 'Item two' }],
+              },
+            ],
+          },
+        ],
+      },
+    ]);
+    expect(extractCommentPlainText(content)).toBe('Item one\nItem two');
+  });
+
+  it('does not double-count the line break for a blockquoted paragraph', () => {
+    const content = tiptapDoc([
+      {
+        type: 'blockquote',
+        content: [
+          {
+            type: 'paragraph',
+            content: [{ type: 'text', text: 'Quoted line' }],
+          },
+        ],
+      },
+      {
+        type: 'paragraph',
+        content: [{ type: 'text', text: 'Next line' }],
+      },
+    ]);
+    // If blockquote also appended its own newline on top of the paragraph's,
+    // this would be 'Quoted line\n\nNext line' instead.
+    expect(extractCommentPlainText(content)).toBe('Quoted line\nNext line');
+  });
+
+  it('matches the reported bug: a ~1,200-char formatted comment exceeds 2000 raw chars but stays under the visible limit', () => {
+    // Alternating bold/plain 5-char words, like a comment with scattered
+    // emphasis — each bold run's marks array is pure JSON overhead.
+    const words = Array.from({ length: 240 }, (_, i) => ({
+      type: 'text',
+      text: 'word ',
+      ...(i % 2 === 0 ? { marks: [{ type: 'bold' }] } : {}),
+    }));
+    const content = tiptapDoc([{ type: 'paragraph', content: words }]);
+
+    // 240 * 5 = 1200 visible characters, well under the 2000 limit.
+    expect(extractCommentPlainText(content).length).toBe(1200);
+    // But the raw JSON (what the old @MaxLength(2000) validated) blows past
+    // it purely from marks/node overhead — this is the bug.
+    expect(content.length).toBeGreaterThan(2000);
+  });
+});

apps/api/src/comments/utils/extract-comment-plain-text.ts

@@ -0,0 +1,88 @@
+/**
+ * Node types whose content represents a separate visual line. A trailing
+ * newline is appended after their text so line/paragraph breaks the user
+ * typed count toward the visible length, matching what they see on screen.
+ * Wrapper types (listItem, tableCell, blockquote, ...) are deliberately
+ * excluded — their children are typically paragraphs that already
+ * contribute a newline, and including the wrapper too would double-count
+ * each line break.
+ */
+const BLOCK_NODE_TYPES = new Set(['paragraph', 'heading', 'codeBlock']);
+
+interface TiptapNode {
+  type?: unknown;
+  text?: unknown;
+  attrs?: unknown;
+  content?: unknown;
+}
+
+function mentionLabel(node: TiptapNode): string {
+  const attrs = node.attrs as { label?: unknown; id?: unknown } | undefined;
+  if (typeof attrs?.label === 'string' && attrs.label) return attrs.label;
+  if (typeof attrs?.id === 'string' && attrs.id) return attrs.id;
+  return '';
+}
+
+function nodeToText(node: unknown): string {
+  if (!node || typeof node !== 'object') return '';
+  const n = node as TiptapNode;
+
+  if (n.type === 'text') {
+    return typeof n.text === 'string' ? n.text : '';
+  }
+
+  if (n.type === 'hardBreak') {
+    return '\n';
+  }
+
+  if (n.type === 'mention') {
+    const label = mentionLabel(n);
+    return label ? `@${label}` : '';
+  }
+
+  if (Array.isArray(n.content)) {
+    const childText = n.content.map(nodeToText).join('');
+    return BLOCK_NODE_TYPES.has(typeof n.type === 'string' ? n.type : '')
+      ? `${childText}\n`
+      : childText;
+  }
+
+  return '';
+}
+
+function isTiptapDoc(value: unknown): value is TiptapNode {
+  if (!value || typeof value !== 'object') return false;
+  const n = value as TiptapNode;
+  return n.type === 'doc' && Array.isArray(n.content);
+}
+
+/**
+ * Extracts the visible text a user typed from a comment's stored `content`.
+ * Comments accept either raw Tiptap/ProseMirror JSON (from the web editor)
+ * or plain text (from API/MCP callers) — formatting marks, node types, and
+ * attrs are structural overhead that inflates the raw string but adds no
+ * visible characters, so length checks must run against this instead of
+ * `content.length`.
+ *
+ * Only parses `content` as Tiptap when it has the expected `{ type: 'doc',
+ * content: [...] }` shape. A plain-text comment that happens to be valid
+ * JSON (e.g. `{"foo": "..."}`) would otherwise be walked as a node tree,
+ * match no known type, and silently extract to `''` — bypassing the length
+ * check entirely instead of falling back to the raw string.
+ */
+export function extractCommentPlainText(content: string): string {
+  if (typeof content !== 'string') return '';
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return content;
+  }
+
+  if (!isTiptapDoc(parsed)) {
+    return content;
+  }
+
+  return nodeToText(parsed).replace(/\n$/, '');
+}